ISO 27001 in Frauenfeld: certified online, without an auditor on site

Yes. Zertify is an online service. It has no office in Frauenfeld and no local auditors, and it does not need any: the self-assessment, the review, the payment and the certificate all happen in the browser. You need a computer and a person who knows how your company handles data, access rights and incidents.

Frauenfeld is the cantonal capital of Thurgau, but the questionnaire that triggers an ISO 27001 request rarely comes from next door. It comes from a customer in another canton, a purchasing department abroad or a tender portal. Where your office is makes no difference to the certificate. What counts is that your practices match the standard and that the buyer can check the result.

ISO 27001 is voluntary. Companies pick it up when customers start asking for proof of information security. The following kinds of business meet that request most often, in Frauenfeld as elsewhere in Switzerland.

IT service providers and software companies

Their customers send supplier questionnaires with a long section on the information security management system. A certificate answers most of it in one document.

Cloud and hosting providers

Customers store their data with you and want evidence that access, backups and incident handling are under control.

Financial and fiduciary services

Client files, payment data and outsourcing agreements make written security requirements routine.

Healthcare providers and their suppliers

Patient data is sensitive, and partners want to see how it is protected.

E-commerce and online services

Customer accounts and payment flows put you on the radar of larger platform and logistics partners.

Manufacturers and suppliers linked to large customers

When an industrial customer connects your systems to its own or shares drawings and specifications, its purchasing department may require a security certificate.

If a customer expressly demands an on-site audit by a certification body, the classic route is the one to take. If the requirement is a verifiable ISO 27001 certificate, the online route usually meets it without the scheduling and travel.

• Compare the certification routes
• Certification without an on-site audit

ISO 27001:2022 describes how to build an information security management system. At its core is the risk assessment, because it decides which Annex A controls you implement and why. The 2022 edition revised these controls and covers cloud services, data protection and cyber risks, among others.

1. 01

   Assess information security risks

   List your assets, threats and weak points, rate them and decide what to do about each. This belongs to the planning clause (6).

2. 02

   Define a security policy and objectives

   Management signs a policy and sets goals that can be checked. Leadership (clause 5) owns this.

3. 03

   Implement security controls from Annex A

   Choose the controls that answer your risks: access management, backups, supplier control, logging and others.

4. 04

   Prepare a Statement of Applicability

   The SoA records which controls apply, which do not, and the reason for each decision.

5. 05

   Raise awareness and train employees

   Staff must know the rules and their own role. Support (clause 7) covers competence and awareness.

6. 06

   Manage security incidents and learn from them

   Define how incidents are reported, handled and reviewed, and feed the findings back into your controls.

• ISO for small and medium businesses

The certificate is issued by G6 Agency AG under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews every assessment before the certificate is issued. Each certificate carries a number and a QR code on the PDF, and anyone can look it up on the public verification page. A customer's purchasing department can confirm it in seconds.

The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years. Billing is an automatic yearly subscription that you can cancel at any time in your customer account, effective at the end of the current year. If you cancel, the certificate ends with the paid year. Prices include 8.1% Swiss VAT, and you do not need an account to buy.

If you certify to several standards, the discount is 20% for two and 30% for three or more, also on the yearly fee.

• ISO 27001 standard page
• Pricing
• Start the free self-assessment

The steps below take place at your desk. Plan time mainly for the preparation, not for the assessment itself.

1. 01

   Collect your documents

   Have your risk assessment, security policy, Statement of Applicability, training records and incident procedure at hand.

2. 02

   Answer the 48 questions

   Thirteen of them are mandatory requirements of the standard and must all be answered yes. Among the other 35, at least 24 need a yes to pass.

3. 03

   Pay for your first year

   Payment follows a passed assessment. No account is needed.

4. 04

   Receive and share the certificate

   Add the PDF to your tender documents or send the verification link with your supplier questionnaire.

5. 05

   Confirm it every year

   A short online re-audit keeps the certificate current throughout its 3 years of validity.

• How it works